Personal data is information relating to an identified or identifiable person. Some categories are treated as sensitive and require stronger care, including health, genetic and biometric information and the other categories listed in the Act.
What to know
- ✓Names and contact details are obvious examples, but identifiers, location data and online information can also identify a person.
- ✓Sensitive data includes information the Act specifically lists, such as health, genetic and biometric information, political opinions, race or ethnic origin, sex life, gender, age, marital status and family status.
- ✓Sensitive-data processing generally requires written consent unless a statutory exception applies.
- ✓Children’s data attracts additional safeguards under the regulations.
Start with context, not format
Information can be personal whether it is on paper, in a spreadsheet, in a business system, in CCTV footage or held by a service provider. The practical question is whether it relates to a person who can be identified directly or indirectly.
A customer number or device identifier may not name someone on its own, but it can still be personal information where the organisation can connect it to a person.
Why sensitive data changes the risk
Sensitive information can expose people to discrimination, financial harm, stigma or loss of autonomy. Organisations should document why processing is necessary, the lawful ground relied on, who can access the data and how it is protected.
Do not assume that age or gender is ordinary data: both appear in the Act’s definition of sensitive data.
A useful first inventory
List whose data you hold, what fields you collect, where it comes from, why you use it, where it is stored, who receives it, whether it leaves Zimbabwe and when it should be deleted. That becomes the foundation for notices, risk assessments, retention and security decisions.
Read the underlying material
- Cyber and Data Protection Act: definitions and sections 10–12
- S.I. 155 of 2024: section 10(5) on children’s data